card: image first, opening cut to one line, noise removed

README.md

@@ -17,118 +17,86 @@ datasets:
 
 # Horos
 
-**ὅρος** — the inscribed boundary stones of ancient Athens. A horos stood at the edge of
-a plot and announced whose land began there; some carried mortgage terms, some marked
-sacred precincts nobody could enter. This model is a horos for personal data: an
-on-device, multi-label scope router for [Topos](https://github.com/dialoguesai/topos)
-that stands at the boundary of your data and names which region a question belongs to —
-or refuses to let it pass.
-Given a free-text question, it predicts which UMA personal-data **scopes** the question
-touches (e.g. `health:read`, `schedule:read`), predicts an explicit **`none`** class for
-questions that touch no personal data, or signals **uncertainty** so the caller can
-escalate to an LLM. It runs *before* the permission gate — the raw question is the one
-input the pipeline sees pre-grant, which is why this model exists: so that step never
-has to leave the device.
+**The boundary stone for personal data.** A 268 MB on-device router for
+[Topos](https://github.com/dialoguesai/topos): free text in → the data scopes it touches,
+an explicit `none`, or a hand-off to an LLM when it isn't sure.
 
-**This model is a router, not an authorization mechanism.** Every scope it emits is
-still permission-checked downstream. A node without this model escalates to an LLM more
-often; it does not become less safe.
+![How Horos routes a question](routing.png)
 
-## How it routes
+*ὅρος — the stones Athenians planted at property lines: "whose land begins here." Same
+job, for your data. Horos runs before the permission gate, so the raw question never
+leaves the device.*
 
-![How Horos routes a question: act on confident scope sets (1..N), abstain on confident none, escalate ambiguity and ignorance to the pack's LLM](routing.png)
+**Router, not authorizer.** Every scope it emits is still permission-checked downstream.
+A node without Horos escalates more often; it does not become less safe.
 
-## Intended use
+## Use
 
-Deployed as the `scope` role in a Topos model pack, behind the four-branch ladder above:
+The `scope` role in a Topos model pack. Load through `topos.query.scope_head.load_head`
+— it validates the label set against the live scope registry and the training manifest
+against the licence policy before touching a weight. Not intended for any task besides
+Topos scope routing, and not intended to run without the escalation path.
 
 ```
 labels ≥ tau_high, none low, nothing in band → ACT on the scope set (1..N scopes)
-high none, nothing else                      → confident abstain (no personal data)
-any label in [tau_low, tau_high)             → ESCALATE to the pack's LLM (ambiguity)
-nothing anywhere, none included              → ESCALATE to the pack's LLM (ignorance)
+high none, nothing else                      → abstain: no personal data
+any label in [tau_low, tau_high)             → escalate to the pack's LLM (ambiguity)
+nothing anywhere, none included              → escalate to the pack's LLM (ignorance)
 ```
 
-It is **not** intended to be used without the escalation path, and not intended for any
-classification task other than Topos scope routing (its 14 scope labels + `none` are the
-Topos scope registry, versioned; the loader refuses the artifact if the live registry
-has drifted).
+## Numbers
 
-## Numbers, with the method
+Benchmark: `role_classify_8` — 1,071 cases, template-disjoint from training, multi-label
+gold, 24% adversarial negatives. It is built to be hard: don't anchor against CLINC-style
+intent scores. The right column is the same benchmark's LLM baseline.
 
-All measured on `role_classify_8` (1,071 cases, 818 positive / 253 negative), template-
-disjoint from training, threshold 0.70 selected on a pre-training grouped holdout —
-never on this benchmark.
-
-**Do not anchor these numbers against standard intent benchmarks.** This benchmark is
-deliberately adversarial: every positive uses phrasing templates the model never saw,
-gold is multi-label, and 24% of cases are near-miss negatives (third-party probes,
-mechanism/definition traps) built to punish keyword matching. For scale on the *same*
-benchmark: **mistral:7b, a 4.4 GB LLM, scores 0.495 macro-F1** — this 268 MB model beats
-it while running every turn on-device.
-
-| metric | value | mistral:7b, same benchmark |
+| metric | Horos | mistral:7b (4.4 GB) |
 |---|---|---|
 | macro-F1 | **0.512** | 0.495 |
 | exact set match | **0.496** | 0.243 |
 | negatives abstained | **0.984** | 0.126 |
-| single-gold vs multi-gold recall | 0.388 / 0.425 (gap −0.036) | — |
-| dead rate (no opinion incl. `none`) | 0.171 | — |
-| disjoint rate (acted, set shares nothing with gold) | 0.217 | — |
+| single / multi-gold recall | 0.388 / 0.425 | — |
+| dead rate | 0.171 | — |
+| disjoint rate | 0.217 | — |
 | per-scope recall ≥ 0.60 | 2 / 14 | 9 / 14 |
 
-### As the hybrid it is designed to front (head + LLM escalation)
-
-Composed per-case: the head's verdict stands on act/abstain; escalated turns take the
-LLM's actual answer on those exact cases.
+### With its LLM escalation (composed per-case)
 
-| arm | macro-F1 | exact | neg-abstain | wrong-scope/turns | LLM sees |
+| arm | macro-F1 | exact | neg-abstain | wrong-scope | LLM sees |
 |---|---|---|---|---|---|
-| LLM-only mistral:7b (4.4 GB) | 0.495 | 0.243 | 0.126 | 0.237 | 100% |
-| **hybrid: this model + mistral:7b** | **0.550** | **0.524** | **0.972** | **0.143** | **16.4%** |
-| LLM-only llama3.2 (2 GB) | 0.376 | 0.261 | 0.510 | 0.204 | 100% |
-| **hybrid: this model + llama3.2** | **0.500** | **0.508** | **0.976** | 0.146 | 16.4% |
-
-The result that matters for low-RAM machines: **a 2 GB-LLM machine running the hybrid
-(0.500) outperforms a 4.4 GB-LLM machine running LLM-only (0.495)** — the head is 268 MB
-and identical on every hardware tier, so only ~1/6th of traffic degrades with weaker
-hardware.
-
-## Known limitations — read before relying on it
-
-* **Confident-none swallowing.** 222 of 818 benchmark positives (27%) are answered with
-  a confident `none` — silently, with no escalation. This is the model's dominant defect.
-  Measured mechanism: template familiarity (heldout phrasings fall to `none`), not class
-  balance. Callers should treat a `none` on a plausibly-personal question with suspicion.
-* **Per-scope recall is far below production floors** (12 of 14 scopes under 0.60).
-  This artifact has **not** cleared its promotion gate and fronts an LLM in shadow /
-  advisory postures only.
-* All numbers above are **synthetic-benchmark** numbers. Real-traffic behaviour is being
-  measured in shadow mode; median confidence on real language is substantially lower
-  than on generated text.
-* English only. Trained entirely on synthetic templates + the public corpora below —
-  **no user data, ever** (the Topos loader refuses artifacts whose manifest violates
-  this).
-
-## Training data & attribution
-
-| source | licence | rows | role |
-|---|---|---|---|
-| schema-grounded synthetic (Topos) | internal/synthetic | 1,927 | positives |
-| compound conjunctions of the above | internal/synthetic | 1,772 | multi-scope positives |
-| negative twins + concept negatives | internal/synthetic | 1,465 | boundary negatives |
-| [AmazonScience/massive](https://huggingface.co/datasets/AmazonScience/massive) | CC BY 4.0 | 3,500 | real-register `none` + cue-mapped positives |
-| [CLINC150 OOS](https://github.com/clinc/oos-eval) | CC BY 3.0 | 800 | out-of-scope `none` |
-
-This model card is the attribution notice CC BY requires. No share-alike or
-non-commercial data was used; the Topos loader enforces that class of licence refusal
-at load time.
+| mistral:7b alone | 0.495 | 0.243 | 0.126 | 0.237 | 100% |
+| **Horos + mistral:7b** | **0.550** | **0.524** | **0.972** | **0.143** | **16.4%** |
+| llama3.2 (2 GB) alone | 0.376 | 0.261 | 0.510 | 0.204 | 100% |
+| **Horos + llama3.2** | **0.500** | **0.508** | **0.976** | 0.146 | 16.4% |
+
+A 2 GB machine running the hybrid (0.500) beats a 4.4 GB machine running LLM-only
+(0.495): Horos is identical on every hardware tier, so only the escalated ~1/6th of
+traffic degrades with weaker hardware.
+
+## Limitations
+
+* **Confident-none swallowing.** 27% of benchmark positives get a confident `none` —
+  silently, no escalation. The dominant defect; mechanism is template familiarity.
+  Treat a `none` on a plausibly-personal question with suspicion.
+* **12 of 14 scopes are under the 0.60 recall floor.** This artifact has not cleared its
+  promotion gate; it fronts an LLM in shadow/advisory postures only.
+* All numbers are synthetic-benchmark. Real-traffic behaviour is being measured in
+  shadow mode.
+* English only. **No user data, ever** — the loader refuses artifacts whose manifest
+  says otherwise.
+
+## Training data
+
+| source | licence | rows |
+|---|---|---|
+| schema-grounded synthetic + compounds + boundary negatives (Topos) | internal | 5,164 |
+| [AmazonScience/massive](https://huggingface.co/datasets/AmazonScience/massive) | CC BY 4.0 | 3,500 |
+| [CLINC150 OOS](https://github.com/clinc/oos-eval) | CC BY 3.0 | 800 |
+
+This card is the CC BY attribution notice. No share-alike or non-commercial data.
 
 ## Architecture
 
-DistilBERT-base-uncased, 15-label multi-label head (14 scopes + `none`), sigmoid
-outputs, `BCEWithLogitsLoss` with per-label `pos_weight`, max_length 64. Artifact format
-`topos-scope-head-1`: `head.json` (labels, thresholds, corpus manifest, metrics) +
-`model/` (HF-standard). Load through `topos.query.scope_head.load_head`, which validates
-labels against the live scope registry and the manifest against the licence policy
-before any weight is touched.
+DistilBERT-base-uncased, 15 sigmoid outputs (14 scopes + `none`), `BCEWithLogitsLoss`
+with per-label `pos_weight`, max_length 64. Artifact = `head.json` (labels, thresholds,
+manifest, metrics) + `model/` (HF-standard).